|
Christmas ruined after running PPID on myself returns 1
|
#
?
Sep 30, 2022 23:02
|
|
|
|
| # ? Apr 25, 2024 13:37 |
|
|
Lain Iwakura posted:if you have control systems people watching stuff like a hawk (and i would expect as much in both ukraine and russia), With how the year has been going, I'm not sure how much I can agree with the Russia part of this statement. dpkg chopra posted:Christmas ruined after running PPID on myself returns 1 Could be worse, at least you have(?) a pp to id.
|
|
#
?
Oct 1, 2022 01:06
|
|
|
 that was a hell of a cold chill to get on a weekend. turned out to be a false positive, something about the servicenow mid server agent upgrade process caused it.
|
|
#
?
Oct 2, 2022 14:23
|
|
|
long shot but anyone here ever been involved in doing an ACSC IRAP assessment? we're building an environment at work that needs to be IRAP assessed and we've already got a lot of insight to the process and sufficient people working on it but any tips anyone might have would be tite. semi-related. here is a valuable resource for what if you're doing M365 poo poo in AU, the DTA Protected Utility blueprint is aligned with ACSC ISM Protected so you can basically copy+paste it for your design and blam, ISM aligned: https://desktop.gov.au/blueprint/index.html
|
|
#
?
Oct 3, 2022 17:14
|
|
|
https://twitter.com/archillect/status/1576671030298513410
|
|
#
?
Oct 3, 2022 23:08
|
|
|
Wholesome exploitation
|
|
#
?
Oct 4, 2022 02:36
|
|
|
https://www.youtube.com/watch?v=dH6m_lyHrY8
|
|
#
?
Oct 4, 2022 19:49
|
|
|
shouts to the realists
|
|
#
?
Oct 4, 2022 19:50
|
|
|
two fronts 😉
|
|
#
?
Oct 4, 2022 19:51
|
|
|
but cmon who don't respect the msining
|
|
#
?
Oct 4, 2022 19:54
|
|
|
https://twitter.com/qusaialhaddad/status/1577278610410307584?s=46&t=LNlCiROHIKfuMv2HK7y5jA i know that all these sites are probably safe but it’s pretty lol that a lot of advice on the internet is essentially “just pipe this url straight into your terminal it’ll be ok I promise”
|
|
#
?
Oct 5, 2022 04:48
|
|
|
alias yolo="curl $1 | sudo bash"
|
|
#
?
Oct 5, 2022 04:51
|
|
|
There's absolutely nothing dangerous about using curl to access a web site. The dangerous bit is if you take the result of that request and do something stupid with it, like pipe it to sh or whatever.
|
|
#
?
Oct 5, 2022 04:52
|
|
|
yeah, without a pipe/cat/whatever it's just displaying the return from the url, it's not passing it to anything
|
|
#
?
Oct 5, 2022 04:54
|
|
|
until you curl the goat man
|
|
#
?
Oct 5, 2022 04:56
|
|
|
Jabor posted:There's absolutely nothing dangerous about using curl to access a web site.
|
|
#
?
Oct 5, 2022 04:59
|
|
|
dpkg chopra posted:until you curl the goat man would rather pipe
|
|
#
?
Oct 5, 2022 05:00
|
|
|
mystes posted:Escape code injection? the data is not submitted to a command interpreter so the best you can do is mess up the terminal formatting to get something to be executed you’d have to exploit curl itself and that’s probably a pretty mature and bulletproof codebase by now
|
|
#
?
Oct 5, 2022 05:27
|
|
|
Kitfox88 posted:would rather pipe
|
|
#
?
Oct 5, 2022 05:57
|
|
|
haveblue posted:the data is not submitted to a command interpreter so the best you can do is mess up the terminal formatting Of course cat doesn't either
|
|
#
?
Oct 5, 2022 06:19
|
|
|
It is actually worse. curl won't run code unless you find a bad exploit or pipe it into sh or whatever. On the other hand, web browsers will happily run ANY CODE sent to them by a web site.
|
|
#
?
Oct 5, 2022 07:21
|
|
|
mystes posted:The issue is more with terminals. Ideally you shouldn't be able to do anything malicious but iirc there have been a lot of terminal vulnerabilities leading to arbitrary code execution in the past, so a lot of programs will filter out escape codes from untrusted data when displaying it to a terminal to be safe but curl doesn't. what terminal vulnerabilities are you talking about? which ones actually lead to code execution?
|
|
#
?
Oct 5, 2022 07:27
|
|
|
mystes posted:The issue is more with terminals. Ideally you shouldn't be able to do anything malicious but iirc there have been a lot of terminal vulnerabilities leading to arbitrary code execution in the past, so a lot of programs will filter out escape codes from untrusted data when displaying it to a terminal to be safe but curl doesn't. terminals can do some crazy loving poo poo many years ago i had a debian box with cups and xterm. one day i accidentally cat my resume pdf to my terminal and it of course fucks up the terminal itself. i either reset or closed the term and moved on with life. short while later my boss stops by my desk with a garbled copy of my resume and asked what was up. that was when i learned there is a control sequence called media copy that can cause xterm to spew terminal contents out to lpr and on to cups. outhole surfer fucked around with this message at 07:58 on Oct 5, 2022 |
|
#
?
Oct 5, 2022 07:49
|
|
|
in colleg i once crashed one of the solaris workstations by cat /dev/random'ing and just leaving it going for a while 
|
|
#
?
Oct 5, 2022 07:51
|
|
|
i miss the days when you could cat /dev/urandom into /dev/fb0 for a snow crash
|
|
#
?
Oct 5, 2022 09:12
|
|
|
the first time i installed linux i booted it up, played around a bit and noticed i couldn't do anything useful with it, and just tried various combinations of cat /dev/urandom > /dev/sd0 until i bricked the machine
|
|
#
?
Oct 5, 2022 09:23
|
|
|
curl wttr.in
|
|
#
?
Oct 5, 2022 11:45
|
|
|
Carbon dioxide posted:It is actually worse. otoh browsers are a very big target that know they do code execution, and have had a lot of effort put into hardening and mitigations. they're also updated frequently shells... not so much
|
|
#
?
Oct 5, 2022 12:03
|
|
|
i mean in aggregate yeah, browsers are far and away a bigger risk. i'm just saying: never trust someone who believes in unixes enough to voluntarily write a shell
|
|
#
?
Oct 5, 2022 12:04
|
|
|
redleader posted:i mean in aggregate yeah, browsers are far and away a bigger risk. i'm just saying: never trust someone who believes in unixes enough to voluntarily write a shell I knew a guy who was big in Zsh development back in the late 90s, and based on that I subscribe to your theory.
|
|
#
?
Oct 5, 2022 19:12
|
|
|
Antigravitas posted:curl wttr.in i love that site, it's so neat. 
|
|
#
?
Oct 5, 2022 20:34
|
|
|
haveblue posted:to get something to be executed you’d have to exploit curl itself and that’s probably a pretty mature and bulletproof codebase by now I trust curl too, but they think there’s room for improvement which is why they’re replacing some parts of it with Rust components
|
|
#
?
Oct 5, 2022 21:27
|
|
|
Subjunctive posted:I trust curl too, but they think there’s room for improvement which is why they’re replacing some parts of it with Rust components I'm not sure "replacing" is the right way to think about it. curl is adding optional backends for HTTP (using the hyper crate) and TLS (using rustls), but that doesn't mean they're throwing away the other backends (curl supports a good half dozen different TLS implementations). This would be a non-starter for distros that don't have Rust toolchains in their build system.
|
|
#
?
Oct 5, 2022 21:43
|
|
|
Kitfox88 posted:would rather pipe
|
|
#
?
Oct 6, 2022 01:45
|
|
|
https://twitter.com/gsuberland/status/1577708428721623054 my favorite computer themed rap: https://www.youtube.com/watch?v=0rG74rG_ubs
|
|
#
?
Oct 6, 2022 04:02
|
|
|
I guess this would be some great "technically correct" logic if the PCI DSS used the word plaintext without defining it or, indeed, used the word plaintext at all.
|
|
#
?
Oct 6, 2022 13:55
|
|
|
Pile Of Garbage posted:i love that site, it's so neat.
|
|
#
?
Oct 6, 2022 15:55
|
|
|
storing PII in my unsecured databases like
|
|
#
?
Oct 6, 2022 15:56
|
|
|
HELLOMYNAMEIS___ posted:
sorry but thats.. not good
|
|
#
?
Oct 6, 2022 16:01
|
|
|
|
| # ? Apr 25, 2024 13:37 |
|
|
zero knowledge posted:This would be a non-starter for distros that don't have Rust toolchains in their build system. they’re already not building Firefox then, and soon they’ll need it for some kernel drivers, so they’re probably not rustless for very long if they want to stay up to date still some platforms that need an llvm port, I guess
|
|
#
?
Oct 7, 2022 01:46
|
|